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In the following paper we present a new semantics for the well-known strategic logic ATL. It is based 
on adding roles to concurrent game structures, that is at every state, each agent belongs to exactly 
one role, and the role specifies what actions are available to him at that state. We show advantages 
of the new semantics, provide motivating examples based on sensor networks, and analyze model 
checking complexity. 

1 Introduction 

ATL HI is not only a highly-expressive and powerful strategic logic, but also has a relatively low (poly- 
nomial) model checking complexity. However, as investigated by Jamroga and Dix [5 ], in order for the 
complexity to be polynomial, the number of agents must be fixed. If the number of agents is taken as 
a parameter, model checking ATL is A^ -complete or A3 -complete depending on model representation 
|[6l . Also, van der Hoek, Lomuscio and Wooldridge show in [3] that the complexity of model checking 
is polynomial only if an explicit enumeration of all components of the model is assumed. For models 
represented in reactive modules language (RML) complexity of model checking for ATL becomes as hard 
as the satisfiability problem for this logic, namely EXPTIME 

We present an alternative semantics that interprets formulas of ordinary ATL over concurrent game 
structures with roles. Such structures introduce an extra element - a set R of roles and associates each 
agent with exactly one role which are considered homogeneous in the sense that all consequences of the 
actions of the agents belonging to the topical role is captured by considering only the number of "votes" 
an action gets (one vote per agent). 

We present the revised formalism for ATL in Section [2j discuss model checking results in Section [3] 
and conclude in Section [4] 

2 Role-based semantics for ATL 

In this section we will introduce concurrent game structures with roles (RCGS), illustrate them with an 
example and show in Theorem [T] that treating RCGS or CGS as the semantics of ATL are equivalent. 

We will very often refer to sets of natural numbers from 1 to some number n > 1. To simplify the 
reference to such sets we introduce the notation [n] = {1, . . . ,n}. Furthermore we will let A B denote the 
set of functions from B to A. We will often also work with tuples v = (vi , . . . , v n ) and view v as a function 
with domain [n] and write v(i) for v,-. Given a function / :AxB-)-C and a E A, we will use f a to denote 
the function B ->■ C defined by f a (b) = f(a,b) for all b £ B. 
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Definition 1. An RCGS is a tuple H = {srf ,R,M, 2,11, 71, A, 8} where: 

• is a non-empty set of players. In this text we assume = [n]for some n € N, and we reserve n 
to mean the number of agents. 

• Q is the non-empty set of states. 

• R is a non-empty set of roles. In this text we assume R = [i]for some i 6 N. 

• ^ : Q x £/ For a coalition A we write A m to denote the agents in A which belong to role r 
at q, and notably stf m are all the agents in role r at q. 

• n is a set of propositional letters and 7t : Q—> p(H) maps each state to the set of propositions true 
in it. 

• A : <2 x 7? —?• N + is the number of available actions in a given state for a given role. 

• For srf = [n], we say that the set of complete votes for a role r in a state q is V r (q) = {v rq £ 
[ n ] lA(?,r)] | Y,i<a<A(q,r) v r,q{ a ) = \&^r,q\}> the set of functions from the available actions to the number 
of agents performing the action. The functions in this set account for the actions of all the agents. 
The set of complete profiles at q is P(q) = YireR^r(<])- For each q £ Q we have a transition 
function at q, 8 q : P{q) —> Q defining a partial function 8 : Qx {J q eQP( a ) ~^ Q such that for all 

q eQ,PeP(q),8(q,P) = 8 q (P). 

The following example illustrates how RCGS differs from an ordinary concurrent game structure: 

Example 1 (Sensor networks). A wireless sensor network is a system composed of a number of (homo- 
geneous) sensors that can be triggered by various stimuli. In Figure^we show a 1-tier (i.e., completely 
homogeneous) sensor network with n sensors. There are two states in the system with labels correspond- 
ing to an indicator of the network. ->p stands for idle state of the network, while p indicates that the 
network detected a stimulus. In this very simple example we say that k is our threshold, i.e. if at least 
k number of sensors detect something, then p. Since all the sensors behave in the same way we say the 
role of sensors is homogeneous. Hence the system can be modeled using only a single role. This gives 
us the model depicted in Figure^ One can easily add another role to the model if needed, for example 
in a scenario with a "controller" who processes the reported signals, or in a 2-tier network with several 
types of sensors. 



<(n,0)> 




Figure 1: A depiction of Hi - a simple 1-tier sensor network. 

A more complex example is presented in Figure [2] where we add another role to our structure, that 
of a supervisor or controller. The supervisor can act upon sensors' actions, i.e. if the sensors report 
that p, the supervisor can perform q. As illustrated by the drawing, the supervisor has three actions 
available: he can wait, he can reject the message or he can accept the message and proceed to state 
12 performing q (e.g., call the police in an intrusion detection scenario). Finally, in Figure^we sketch 
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Figure 2: A sketch of structure H 2 : a 1-tier sensor network with a supervisor. 



a multi-tier example, with two different types of sensors, n\ and n 2 , each type with its corresponding role. 
The transition function with the addition of a new role looks like this: 



5 ?0 (((xi,«i -xi),(x 2 ,n 2 -x 2 ))) 



<7i, X\ > t\ l\x 2 > ?2 



qo, otherwise 

8qi((ni,n 2 )) = qo 
where t\,t 2 are thresholds set according to significance of the sensors. 

{(ti,?»i - h), (t 2 ,n 2 - h)) 

' p 




Figure 3: A sketch of structure Hy. a multi-tier sensor network example. 

These simple structures show the benefit of using roles when modelling scenarios which involve 
a high degree of homogeneity among agents. In this simplified sensor setting a sensor either signals 
that he has made a relevant observation or he does not — a binary choice. If modelled using concurrent 
game structures without roles, models would have 1 n number of possible action profiles in state qo, since 
the identity of the agents signaling that they have made an observation has to be accounted for. This, 
however, is irrelevant for the high-level protocol — all that matters is how many sensors of a given type 
signal that they have made an observation. With roles we can exploit this, and we only need to account 
for the genuinely different scenarios that can occur — corresponding to the number of sensors of each 
type that decide to signal that they have made an observation. In the case of just a single role, this 
means that we get n as opposed to 2 n number of different profiles, and the size of the model goes from 
exponential to linear in the number of sensors. In general, as we will show in Section [J] we shift the 
exponential dependence in the size of models from the number of agents to the number of roles. 

Given a role r, a state q and a coalition A, the set of A- votes for r at q is V r (q,A), defined as: 

Vr (qA) = \vG[\A, q \]^ £ v(a) = ^, 4 ||. 

I «e[A(«,r)] J 



64 



Concurrent Game Structures with Roles 



The A-votes for r at q give the possible ways agents in A that are in role r at q can vote. Given a state q 
and a coalition A, we define the set of A -profiles at q: 

P(q,A) = {(v u ...,v ]R] ) | 1< i< \R\: Vi eV r (q,A)}- 

For any v E V r (#,A) and w E V r (g,fi) we write v < w iff for all i E [A(#, r)] we have v(z') < w(i). If v < w, 
we say that w extends v. If F = (vi,...,Vr) E P(q,A) and F' = (vj,...,v^) E P(q,B) with v, < v'- for 
every 1 < i < \R\, we say that F < F' and that F extends F' . Given a (partial) profile F' at a state q we 
write ext(q,F) for the set of all complete profiles that extend F'. 

Given two states q,q' E Q, we say that q' is a successor of g if there is some F £ P(q) such that 
8(q,F) = q'. A computation is an infinite sequence A = go<7i • • • of states such that for all positions 
i > 0, is a successor of g,-. We follow standard abbreviations, hence a ^-computation denotes a 
computation starting at q, and X[i], A[0,d and A[/,°°] denote the i-th state, the finite prefix go<7i ■■■<li 
and the infinite suffix qtqt+i ... of A for any computation A and its position i > 0, respectively. An A- 
strategy for A C ^ is a function .sa : <2 — >• U^eG^C^;^) sucn t na * E P(q,A) for all q £ Q. That is, 
maps states to A-profiles at that state. The set of all A-strategies is denoted by stmt {A). When needed 
to distinguish between different structures we write stmt (S, A) to indicate that we are talking about the 
set of strategies for A in structure S. If s is an ^/-strategy and we apply 8 q to s(q), we obtain a unique 
new state q' = 8 q (s(q)). Iterating, we get the induced computation X S) q = qoqi ■ ■ ■ such that q = qo and 
V/ > : S qi (s(qi)) = qt+i. Given two strategies s and s', we say that s <s' iff \/q E Q : s(q) < s'(q). Given 
an A-strategy sa and a state q we get an associated set of computations out(sA,q)- This is the set of all 
computations that can result when at any state, the players in A are voting/acting in the way specified by 
sa, that is out(sA,q) = {A Ji9 | s is an si -strategy and s > sa}- 

Given the definitions above, we can interpret ATL formulas in the following manner, leaving out the 
propositional cases and abbreviations: 

Definition 2. Given a RCGS S and a state q in S, we define the satisfaction relation |= inductively: 

• S,q \= ((A)) O iff there is sa E stmt (A) such that for all A E out(sA,q), we have S, A[l] (= 

• S,q \= ((A)) 0' iff there is sa E stmt (A) such that for all A E out(sA,q) we have S,X[i] \= 0' and 
S, A [j] |= for some i > and for all < j < i 

Towards the statement that interpreting formulas over CGS and RCGS is equivalent (Theorem [TJ we 
will describe a surjective translation function / translating each RCGS to a CGS. The following two 
lemmas will be useful in formulating the proof of Theorem [T] 

The translation function / from RCGS to CGS is defined as follows: 

f(*f,R,i%,Q,n,7t,A,8) = «G,n,Mi«') 

where: 

d a (q)=A(q,r) where a E &(q, r) 

8'(q,GCi,. . .,a n ) = 8(q,v\, . . . ,viri) where for each role r 

v r = (\{i£M(q,r) | ai=l}\,...,\{i£M(q,r) \ Oi=A(q,r)}\) 

We describe a surjective function m : strat(f(S)) — > strat(S) mapping action tuples and strategies 
of f(S) to profiles and strategies of S respectively. For all A C s/ and any action tuple for A at q, 
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tq = (ce ai ,ce a2 , ...,a fl | A| ) with 1 < a a . < d a .{q) for all 1 < i < \A\, the A-profile m(t q ) is defined in the 
following way: 

m(t q ) = {v(t q , 1), . . . ,v(i q , \R\)) where for all 1 < r < \R\ we have 
v(t q ,r) = {\{aeA m | a a = l}\,...,\{aeA m \ a a = A(q,r)}\) 

Lemma 1. For any RCGS S and any A C s/, the function m : strat(f(S),A) — > strat (5, A) is surjective. 

Proof. Let pa be some strategy for A in S. We must show there is a strategy sa in /(S) such that 
wi^a) = Pa- For all g G Q, we must define sa(<?) appropriately. Consider the profile /?a(<?) = (vi,. • • >v\r\) 
and note that by definition of a profile, all v r for 1 < r < |/?| are A-votes for r and that by definition of 
an A-vote, we have Y,\<i<Mq,r) v r{i) = \A r ,q\- Also, for all agents a, a' G A n9 we know, by definition of /, 
that d a (q) = <i fl '(^) = A(q,r). 

It follows that there are functions a : A — > N + such that for all a G A, ce(a) G [rf fl (^)] and |{a G A m \ 
a{a) = i}\ = v r (i) for all 1 < i < A(q,r), i.e. 

v r = (\{a G A r , q \a{a) = 1}|, . . . , \{a G A m \a{a) = A(q,r)}\) 

We choose some such a and sa = (a(a\), . . . , CU (am)}. Having defined ^ in this way, it is clear that 
m(s A )=PA- □ 

It will be useful to have access to the set of states that can result in the next step when A C follows 
strategy sa at state q, succ(q,SA) = {q' G Q \ 3F G ext{q,SA) '■ 8(q,F) = q'}. Given either a CGS or an 
RCGS S, we define the set of sets of states that a coalition A can enforce in the next state of the game: 

force(S,q,A) = {succ(q,SA) \ sa is a strategy for A in S}. 

Using the surjective function m we can prove the following lemma, showing that the "next time" 
strength of any coalition A is the same in S as it is in f(S). 

Lemma 2. For any RCGS S, and state q G Q and any coalition A C srf ', we have force(S,A,q) = 
force(f(S),A,q). ' 

Proof. By definition of force and Lemma[T]it is sufficient to show that for all sa G strat(f(S),A), we 
have succ(S,m(sA),q) = succ(f(S),SA,q)- We show C as follows: Assume that q' G force(S,m(sA),q)- 
Then there is some complete profile P = (vi, . . . ,v\ R \), extending m{sA){q), such that 8(q,P) = q'. Let 
m{sA){q) = {w\ , . . . , w\ R \ ) and form P' = (v[ , . . . , vLi ) defined by v\ = V/ — w; for all 1 < i < \R\. Then 
each v'j is an (jz/ \ A)-vote for role i, meaning that the sum of entries in the tuple v\ is | (&/ \ A) n9 |. 
This means that we can define a function a : £/ — > N + such that for all a G a(a) G [<5?a(g)] and 
for all a G A, a(a) = s fl (g) and for every r£fi and every a G (=2/ \ A), and every 1 < j < A(q,r), 
\{a G \ A) m I a{a) = j}\ = v' r (j). Having defined a like this it follows by definition of m that for 
all 1 < j < A(q,r), \{a G A m \ a(a) = j}\ = w r (j). Then for all r G R and all 1 < j < A(q,r) we 
have \{a G s^ q . r \ a{a) = j}\ = v r (j). By definition of f(S) it follows that q' = 8(q,P) = 8'(q,a) so 
that q' G force(f(S),SA,q)- We conclude that force(S,f(sA),q) C force(f(S),SA,q)- The direction D 
follows easily from the definitions of m and /. □ 

We now state and prove the equivalence. 

Theorem 1. For any RCGS S, any and any q G Q, we have S,q \= (j> ifff(S),q |=cgs 0, where f is the 
surjective model-translation function. 



66 



Concurrent Game Structures with Roles 



Proof. Given a structure S, and a formula <p, we define true(S, (j)) = {q £ Q \ S ,q \= <p}. Equivalence of 
models 5 and f(S) is now demonstrated by showing that the equivalence in next time strength established 
in Lemma [2] suffices to conclude that true(S,<j>) = tme(f(S),<j)) for all <p. 

We prove the theorem by showing that for all <p, we have true(S,<j>) = true(f(S),<p). We use in- 
duction on complexity of <p. The base case for atomic formulas and the inductive steps for Boolean 
connectives are trivial, while the case of ((A)) O is a straightforward application of Lemma [2j For 
the cases of ((A)) and ((A)) <p%y we rely on the following fixed point characterizations, which are 
well-known to hold for ATL, see for instance O, and are also easily verified against definition |2j 

((A))D0^0A((A))O((A))D0 
{<£))<h&<h O <fc V (0i A ((A)) O ((A))faW<h 

We show the induction step for ((A))D0, taking as induction hypothesis true(S,<p) = true(f(S),(j>). The 
first equivalence above identifies Q' = true(S, ((A)) as the maximal subset of 2 such that is true 
at every state in Q' and such that A can enforce a state in Q' from every state in Q', i.e. such that 
\/q 6 2' : 32" G force(q,A) : Q" C 2'. Notice that a unique such set always exists. This is clear since 
the union of two sets satisfying the two requirements will itself satisfy them (possibly the empty set). 
The first requirement, namely that <p is true at all states in Q', holds for S iff if holds for f(S) by induction 
hypothesis. Lemma [2] states force(S,q,A) = force(f(S),q,A), and this implies that also the second re- 
quirement holds in 5 iff it holds in f(S). From this we conclude true(S, ((A))n<j>) = true(f(S),((A))0$) 
as desired. The case for ((A)) (j)^ y is similar, using the second equivalence. □ 

Example 2 (Sensor networks contd.). To further illustrate the use of ATL interpreted over RCGS, we 
provide example formulas that are related to the structures shown in Example^ 

In the structure depicted in Figure^ if at least k sensors signal something, p becomes true (e.g. the 
alarm is raised). This is expressed by formula ((A)) O P which is satisfied in the structure from Figure^ 
i.e. H\,qo\= ((A)) O P whenever \An£%(qo, 1)| > k. In Figure^ the supervisor decides whether signals 
that indicate p are strong enough in order for him to signal q, e.g. raise the alarm. In this scenario, the 
sensors alone cannot raise the alarm, hence H%,qo \/= ((A))()q whenever AD &(qi, 2) = (which means 
that whenever the coalition A does not include the supervisor, q cannot be enforced). On the other hand, 
#2,<7o H ((A)) O ((B)) Oq whenever \An&(qo,l)\ > k and finJ(^,2) ^ (which means that the 
coalition of agents without a supervisor can enable the supervisor to take action). 



3 Model checking and the size of models 

In this section we will see how using roles can lead to a dramatic decrease in the size of ATL models. 
We first investigate the size of models in terms of the number of roles, players and actions, and then we 
analyze model checking of ATL over concurrent game structures with roles. 

Given a set of numbers [a] and a number n, it is a well-known combinatorial fact that the number 
of ways in which to choose n elements from [a], allowing repetitions, is j^y ! ■ Furthermore, this 



number satisfies the following two inequalities Q 



{n+(a-l))\ < „ , (r^ya-i,,: < a ? 

n\{a-\)\ - a dnU n!(a-l)! - - ^' 



1 If this is not clear, remember that n" and a" are the number of functions [n] M and [a] W respectively. It should not be hard 
to see that all ways in which to choose n elements from a induce non-intersecting sets of functions of both types. 
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These two inequalities provide us with an upper bound on the size of RCGS models that makes it easy to 
compare their sizes to that of CGS models. Typically, the size of concurrent game structures is dominated 
by the size of the domain of the transition function. For an RCGS and a given state q G Q this is the 
number of complete profiles at q. To measure it, remember that every complete profile is an \R\ -tuple of 
votes v r , one for each role r G R. Also remember that a vote v,- for r G R is an A(q, r)-tuple such that the 
sum of entries is \^q, r \- Equivalently, the vote v r can be seen as the number of ways in which we can 
make \s^ q ^ r \ choices, allowing repetitions, from a set of A(q,r) alternatives. Looking at it this way, we 
obtain: 

{p( n (Kr| + (A(g,r)-l))! 
1 m 11 K,|!(Afo,r)-l))! • 

We sum over all q G Q to obtain what we consider to be the size of an RCGS S. In light of Equation|2] it 
follows that the size of S is upper bounded by both of the following expressions. 

^(I^fiOe*Kr| A( *' r) ) and @VL q&Q Y[ r&R A(q,r)\<'\). (3) 

We observe that growth in the size of models is polynomial in a = max 96 g irG #A(r, q) if n=\srf\ and \R\ is 
fixed, and polynomial in p = max q eQ,reR\^q,r\ if a and \R\ are fixed. This identifies a significant potential 
advantage arising from introducing roles to the semantics of ATL. The size of a CGS M, when measured 
in the same way, replacing complete profiles at q by complete action tuples at q, grows exponentially in 
the players whenever the players have more than one action. We stress that we are not just counting the 
number of transitions in our models differently. We do have an additional parameter, the roles, but this is 
a new semantic construct that gives rise to genuinely different semantic structures. We have established 
that it is possible to use them to give the semantics of ATL, but this does not mean that there is not more 
to be said about them. Particularly crucial is the question of model checking over RCGS models. 

3.1 Model checking using roles 

For ATL there is a well known model checking algorithm [1]. It does model checking in time linear in 
the length of the formula and the size of the model. Given a structure S, and a formula <p , the standard 
model checking algorithm mcheck(S,(f)) returns the set of states of S where </> holds. 

The algorithm depends on a function enforce(S,A,q, Q'), 
which given a structure S, a coalition A, a state q G Q and a f r F G P(q,A) do 
set of states Q' answers true or false depending on whether p ^_ true 

or not A can enforce Q' from q. This is the only part of the f r F' G ext(q,F) do 

standard algorithm that needs to be modified to accommo- if 8 (q,F r ) G" Q' then 

date roles. p <_ f a \ se 

For all profiles F G P(q,A) the enforce algorithm runs if p = true then 

through all complete profiles F' G P(q) that extend F. It is return true 

polynomial in the number of complete profiles, since for any return false 
coalition A and state q we have \P (q,A)\ < \P(q)\, meaning 

that the complexity of enforce is upper bounded by \P{q) | 2 . Figure 4: enforce(S,A,q, Q') 

Given a fixed length formula and a fixed number of states, 

enforce dominates the running time of mcheck. It follows that model checking of ATL over concurrent 
game structures with roles is polynomial in the size of the model. We summarize this result. 

Proposition 1. Given a CGS S and a formula (j), mcheck(S,<j)) takes time ff(le 2 ) where I is the length of 
(f) and e = £ 1^(^)1 is the total number of transitions in S 
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Since model checking ATL over CGSs takes only linear time, &(le), adding roles apparently makes 
model checking harder. On the other hand, the size of CGS models can be bigger by an exponential 
factor, making model checking much easier after adding roles. In light of the bounds we have on the size 
of models, c.f. Equation [3} we find that as long as the roles and the actions remain fixed, complexity of 
model checking is only polynomial in the number of agents. This is a potentially significant argument in 
favor of including roles in the semantics. 

Roles should be used at the modeling stage, as they give the modeler an opportunity for exploiting 
homogeneity of the system under consideration. We think that it is reasonable to hypothesize that in 
practice, most large scale multi-agent systems that lend themselves well to modeling by ATL exhibit 
significant homogeneity. 

The question arises as to whether or not using an RCGS is always the best choice, or if there are 
situations when the losses incurred in the complexity of model checking outweigh the gains we make in 
terms of the size of models. We conclude with the following proposition, also shown in [|2]], which states 
that as long we use the standard algorithm, model checking any CGS M can be done at least as quickly 
by model checking an arbitrary S £ /~ (M). 

Proposition 2. Given any CGS-model M and any formula 0, let c(mcheck(M ,(j>)) denote the complexity 
of running mcheck(M,(j)). We have, for all S £ f~(M), that complexity of running mcheclc(S , (j)) is 
ff{c(mcheck{M,§)) 



Proof. It is clear that for any S £ f~ (M), running mcheck(S,<p) and mcheck(M,(j>), a difference in overall 
complexity can arise only from a difference in the complexity of enforce. So we compare the complexity 
of enforce(S,A,q,Q") and enforce(M,A,q,Q") for some arbitrary q £ Q, Q" C Q. The complexity in 
both cases involves passing through all complete extensions of all strategies for A at q. The sizes of these 
sets can be compared as follows, the first inequality is an instance of Equation[2]and the equalities follow 
from definition of / and the fact that M = f(S). 



n f - (|A r , g | + (A(r,g)-l))! \ n ( ((K,,| - \A m \) + (A(r,q) - 1))! 
AH \A m \\(A(r,q)-iy > H 



reR 



reR 



(K r |-|A,,|)!(A(r,4)-l)! 



<[HA(r,q)\ A ^xllA(r,q) 



.reR 



reR 



n n am xji n a (^) 



reR \aeA rll 



reR \aes^ air \A rA 



Y\d a (q) x Y\ d a (q) = Y[ d a {q) 

\aeA aesf\A / aesrf 



We started with the number of profiles (transitions) we need to inspect when running enforce on S at q, 
and ended with the number of action tuples (transitions) we need to inspect when running enforce on 
M = f(S). Since we showed the first to be smaller or equal to the latter and the execution of all other 
elements of mcheck are identical between S and M, the claim follows. □ 
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4 Conclusions, related and future work 

In this paper we have described a new type of semantics for the strategic logic ATL. We have provided 
illustrating examples and argued that although in principle model checking ATL interpreted over con- 
current game structures with roles is harder than the standard approach, it is still polynomial and can 
generate exponentially smaller models. We believe this provides evidence that concurrent game struc- 
tures with roles are an interesting semantics for ATL, and should be investigated further. 

Relating our work to ideas already present in the literature we find it somewhat similar to the idea 
of exploiting symmetry in model checking, as investigated by Sistla and Godefroid [7]. However, our 
approach is different, since we look at agent symmetries in ATL as the basis of a new semantics. When 
it comes to work related directly to strategic logics, we find no similar ideas present, hence concluding 
that our approach is indeed novel. 

For future work we plan on investigating the homogeneous aspect of our 'roles' in more depth. We 
are currently working on a derivative of ATL with a different language that will fully exploit the role 
based semantics. 
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